official copy 1 of 1 unproofed transcriptmain roads · 20-11-2019 · official copy 1 of 1 ....

OFFICIAL Copy 1 of 1

EVIDENCE GIVEN BY GEOFFREY MAGOFFIN of 42 Transcriber: Epiq RL/CS File No. CO-19-1209

CRIME AND CORRUPTION COMMISSION

TRANSCRIPT OF INVESTIGATIVE HEARING

CONDUCTED AT LEVEL 2, NORTH TOWER, 515 ST PAULS TERRACE, 10 FORTITUDE VALLEY WITH RESPECT TO

File No: CO-19-1209

OPERATION IMPALA HEARING NO: 19/0006

DAY 8 - WEDNESDAY 20 NOVEMBER 2019 (DURATION: 1HR 57MINS) 20

Copies of this transcript must not be made or distributed except in accordance with any order made by the presiding officer concerning publication of these

proceedings.

LEGEND

PO Presiding Officer – ALAN MACSPORRAN QC 30 CA Counsel Assisting – JULIE FOTHERINGHAM HRO Hearing Room Orderly – KIMBERLEY SAUNDERS W Witness – GEOFFREY MAGOFFIN LR Legal Representative – MR G.J. HUMBLE, for Department of Transport and

Main Roads UNPROOFED TRANSC

RIPT



CA I call Mr MAGOFFIN. PO Mr MAGOFFIN, would you prefer an oath or affirmation? W Oath, thanks. HRO The evidence which I shall give. W The evidence that I shall give. 10 HRO In these proceedings. W In these proceedings. HRO Shall be the truth. W Shall be the truth. HRO The whole truth. 20 W The whole truth. HRO And nothing but the truth. W And nothing but the truth. HRO So help me God. W So help me God. 30 HRO Thank you. . LR Commissioner, my name is Humble, initials G.J. from McCulloch Robinson and

I appear for the Department of Transport and Main Roads, in this instance on behalf of Mr MAGOFFIN.

PO Thanks, Mr HUMBLE. CA Good afternoon, Mr MAGOFFIN. 40 W Good afternoon. CA You've been provided with a notice to attend today? W I have. CA Yes. I will just show you a copy of that notice. Is that the notice?

UNPROOFED TRANSC

RIPT



W Yes, it is. CA I tender that document. PO Exhibit 144. ADMITTED AND MARKED EXHIBIT 144 CA Mr MAGOFFIN, you're the General Manager for the Department of Transport

and Main Roads and have been in that position since 2012. 10 W That's correct. CA And prior to that, you worked as State Manager for banks at Rural Bank, was

it? W That's right. CA For a few years and then prior to that was a Regional Manager for Suncorp

Bank? 20 W That's right. CA Your qualifications are that you hold a Master of Business Administration from

the Queensland University of Technology and a Graduate Diploma in Business Administration, as well as a Graduate Certificate in that same area. So your agency has provided the Commission with some material with respect to fleshing out some of the questioning of the two witnesses from the first day of this public hearing?

30 W Yes. CA So I'll just go through that with you and then I might, during that process, ask

you a couple of other questions as well, if it touches on a subject where I've already prepared some questions. So we might just start to work through that. So the first one, my question was, regarding customer records suppression policy with access to level 1 suppressed records, TICA and TRAILS, the Director-General suggested that there is a flag produced every time the record is accessed, where does this report go to? And you've got a response providing quite a lot of information in relation to that. Would you like to go through that? 40

W Yes, I can. CA Have you got that document, because if you want we can provide you a copy. W I'd like a copy, thanks, yeah. CA You want a copy?

UNPROOFED TRANSC

RIPT



W Yes, please. CA We won't tender it, but you can just have it for your reference notes as a prompt. W Thank you. Okay, sorry, can you repeat the question? CA Yes, it’s just from that document, when a flag is produced every time a record

is accessed on TICA or TRAILS where does the report go to? 10 W Under suppressed records? CA Yes, the customer records suppression policy at level 1. W So the Level 1 suppression, the customer service officer at the frontline gets a

flag or a text on the screen that says they have to refer that through to the Identity Management Unit.

CA Yes. 20 W And from there they contact that unit and authenticate that person over the

phone through that process. CA So the Identity Management Unit, you call it IMU? W IMU, yes. CA And that has six staff? W That's right. 30 CA And the main role of an IMU officer is for detection, recording and analysis of

identity fraud related incidents and the management of customer suppression records?

W That's correct. CA And the suppression level types, there are two of them? W That's correct. 40 CA For level 1, a member of the public can obtain protection under that suppression

level by providing your agency with what documents? W That person provides a report or letter from the enforcement agency signed by

a commissioned officer, or a court protection order supporting the need for that suppression.

UNPROOFED TRANSC

RIPT



CA And then level 2, what is required to obtain level 2? W Level 2 is where a person comes with a statutory dec signed by a JP or a letter

from a domestic and family violence organisation supporting the need for a suppression. So it is a stat dec approach there.

CA And then as far as access for your staff to the suppressed records, the IMU staff

have access to both levels of records? W That's correct. 10 CA Where they can see – how much information can they see about each member

of the public with that protection? W The IMU staff, they can view the customer's name, address, facial image and

other TMR details such as driver's licence, classes, effective and expiry dates. CA Now Queensland Police Service staff have access to level 2? W That's correct. 20 CA Yes. And what can they view? W So QPS staff only have access to level 2 customer suppression records where

they can view the customer's name and address and other TMR details such as driver's licence, classes, effective and expiry dates. But they cannot view the facial imaging.

CA And then for Queensland Police Service staff can they view level 1 records? 30 W No, they can't. CA And then your agency's staff outside of that unit, what can they view, if

anything, of the records? W Again, if they go into those records a flag will come up to say to contact the

IMU. They can't see any of the facial imaging, address or name. They can only see that they do have a driver's licence, whether it’s valid or not, those sorts of details. But they don't have any other information about that customer.

40 CA And what about release of information for members of the public who are

protected under that suppression structure you have. Is there a release of their details over the telephone upon request?

W No, they're not. Again if they rang our contact centre the contact centre would

refer that customer to actually have to go in physically to a customer service centre and identify themselves through that process and seek whatever information they need from there.

UNPROOFED TRANSC

RIPT



CA And then what happens with any associated hard copy, so paperwork to do with

those records? W That's all stored under secure arrangements at the IMU, of which the IMU staff

are the only ones who have access to that through swipe cards and other security there.

CA Are there any additional checks and balances on the staff employed at that

specialist unit? 10 W Yes, there are. They're typically under the same scrutiny as any of our customer

service officers who have access to our systems. In addition to that, they have annual police checks, they have the typical auditing process through our internal audit unit as well.

CA And do they have confidentiality agreements? W Yes, they do. 20 CA Do other staff members, are they required to sign confidentiality agreements? W Outside the IMU? CA Yes. W No. CA And just while we're on that topic, what occurs with respect to declarable

interests and associations, what's the policy there? It's not in the response 30 material.

W No, I'm just trying to remember. They do have conflict of interests agreements

that they have to sign. The specifics of that I just can't remember offhand. CA Just going on your agency, the same as the others, have provided two responses

to two requests prior to the public hearings. W Yes. 40 CA For Operation Impala. The first one was filling out essentially a questionnaire

and the second one was providing responses to questions going from an analysis of the questionnaire. So just going from that material, the response from your agency was that all employees are bound by declaring possible conflicts of interest upon commencement?

W Yes.

UNPROOFED TRANSC

RIPT



CA And when assigned to a task that may potentially or possibly be a conflict of interest. Is that correct?

W Say that last bit again? CA And also when assigned to a task that may potentially or possibly be a conflict

of interest. W Yes. 10 CA And in the response material it’s said that there's an annual updating for SES

and equivalent level employees? W That's correct. CA Is it possible for that annual updating to extend to all employees? W I suppose it's possible. It’s quite a logistical nightmare given I’ve got some

upwards of 1,500, 1,600 staff, plus I also have 2,000 school crossing supervisors under my steerage. So that's quite a logistical nightmare to manage. It is 20 possible, but, yeah.

CA Because with your agency it is one of the ones that does tend to get targeted

more than others from sort of the grooming outsider aspect of things. W Sure. CA With respect to misuse of information. W Yes. 30 CA So, well, we'll go through some of the case studies in a minute, but it’s usually

helping someone else out. Accessing the system to help out your brother-in-law, your mother.

W Yes. CA So the declarable interest is of particular significance to your agency when

comparing with the other agencies. I mean not the only one- 40 W Sure. CA -but is one where an annual or at least some type of regular requirement instead

of just relying on the good sorts of your staff to do the right thing- W Yes. CA -would be a good preventative function potentially?

UNPROOFED TRANSC

RIPT



W Yeah. I suppose I'd look to other defence mechanisms before going down a path

of, you know, self-declaring your interests there. If someone was wanting to be fraudulent or of that nature, I'm not sure filling out a declaration every year will draw them out, if you like. In TMR we have - are you happy for me to go through a framework of where I think may cover off some of that?

CA Yes. Did you want to finish off about the suppression records? Yes. W Well, let me go through this, if that’s okay. And that might help frame some of 10

the answers going forward. CA Yes. W So our DG and CIO spoke on the first day at the hearing around our technical

systems in regards to login screens, our IT systems and some of the algorithms running in the background in regards to security and anomalies in that way. So in addition to that we have in our business systems, if you like, a number of factors that we've implemented over the time. And that's around local management doing audits and checks, a monthly checklist and reviews of a 20 number of controls around the information and the system access on the frontline.

In addition to that, I've, since 2013 or '14, looked at investing a Director of Governance within the branch who has steerage over strengthening some of those systems that we have already in place and enhancing those. We've also invested an additional six FTEs who are our quality assurance officers who routinely go through all our different business units, looking at business exceptions and other more comprehensive range of controls. And over and above that we have our internal audit who do regular spot checks and program 30 audits throughout the network. So quite a detailed approach there. We're also looking into the new year at looking at a proof of concept around getting developers in to use data analytics and artificial intelligence into some of our data sets from a business systems point of view, not an IT, if you like. And that's looking at some of the unusual transactions that may pop up on the horizon there. So we're looking at those sort of systems to help us have a look at the network as a whole.

So then, that's the second form of defence, if you like. And our third form is around people and culture. And a lot of this, hopefully, will draw out some of 40 that rather than the need of a conflict of interest every year, which I think is doable, but I think maybe an administrative nightmare to manage. You know all of our new staff have criminal history checks. We have a yearly mandatory online training. And that covers off a wealth of different things. And if you're happy I'll talk to that.

CA I've got a whole section on training.

UNPROOFED TRANSC

RIPT



W Okay, okay. CA We can go onto that later because we're still on the suppression records. W I'll hold off there and let you continue then. CA Okay. So just finishing off on the suppression policy. W Yes. 10 CA You do monthly audits and also an annual audit? W Yes. CA And then as an internal audit unit as well, which does make recommendations

for further implementations to provide protections such as the 12-month criminal history check and the swipe card access?

W That's right. 20 CA So the second question that your agency wanted me to raise with you, flowing

from the appearances last week, that’s my question, have you conducted any customer surveys specifically in relation to privacy?

W Not specifically to privacy. A lot of our surveys is about the customer

experience, how they found different aspects of our products and services. Probably the online services questionnaires may highlight whether they trust the systems, but there's nothing directly about privacy.

CA And the concerns raised through the surveys relate to use of the internet more 30

generally? W That's right. CA And the next question, I'll just read it out. “In relation to prevention from the

issuing of general warnings do you send emails to all employees as part of that?” W Yes, I do. And that was sort of where I was getting into the people and culture

part of it, where we have our mandatory training. Through experience over the last seven or so years it became aware that the staff weren't necessarily aware 40 of their roles and responsibilities, particularly when it came to the Privacy Act. And so through that I've initiated a number of campaigns which in 2017 we developed a campaign about a Peek is a Breach and that talks to-

CA I've got copies of what you provided us here. W Yes.

UNPROOFED TRANSC

RIPT



CA Ready to put on the big screen and tender. Would you like to read through them?

W Absolutely, yes. CA I'll just show Mr MAGOFFIN the email and related correspondence. W Thank you. CA I tender that document. So if you could just go through that with us. I think it 10

starts, not with the Peek is a Breach but with a second – we've already had one email tendered through the Director-General, and this is a second email the same year from you that your office has provided to us.

W Sure. CA Yes. So if you just speak to it in turn, the documents. W Okay. There's a whole suite of other campaigns and associated collateral that

I'm happy to hand over. 20 CA Maybe we’ll go through this. W Okay. CA And then you could sort of summarise those and we'll see if we need to, yes. W Okay. So you're asking me to read these? CA No, just to explain. You send regular emails of this nature? 30 W So the campaign is a multi-pronged approach. Yes, I send emails explaining

their roles and responsibilities in regards to when it comes to privacy. I talk about unauthorised access is prohibited by law, customers and community are entitled to privacy of their personal information as prescribed in the Information Privacy Act 2009.

CA And this is to all staff? W To all staff under my carriage. And it goes on with some detail there. So emails 40

are part of it. I have regular videos of myself speaking to some of that content. We also have the posters that we mentioned earlier. They are all in the back office highlighting the need to maintain information privacy of our customers. We also have tool box talks. So that's where the local teams get together with their line manager.

CA I’ll just tender that document.

UNPROOFED TRANSC

RIPT



PO Exhibit 145. ADMITTED AND MARKED EXHIBIT 145 CA Just with the email we did have an expert last week, it was the same day as your

colleagues attended. W Yes. CA Professor SMITH. And he did say, with respect to you know, prevention, that 10

the range of sanctions is a good idea to raise. W Yes. CA So disciplinary, criminal. W Yes. CA Yes. 20 W So this was our first sort of foray into the campaigns and as we build on each

year we're building on those campaigns to make everybody aware of the consequences of their conduct when dealing with this.

CA So you’ve got the tool box talk is the next document we’ve attached. W Yes. CA Would you like to talk to the frequency and content of the toolbox talks? 30 W The tool box talks in their own right are held quite regularly, but different topics.

But specifically with regards to privacy they're held quarterly and that's where the local line manager will go through the policy, how it affects the staff, what are the implications of breaching those, what is not authorised access when they're accessing TICA or TRAILS. Those sorts of flavours. There’s a number of activities to engage with the staff so that they not only sit there and listen but they're actively engaged in understanding, well, here's a scenario, how does it play out and what should they do about that.

CA And then the next form you provided was a training sign-off sheet. So is all 40

training the records of participation? W Correct. Everybody that participates in a tool box talk signs a record. CA That's for the tool box talk? W That's right.

UNPROOFED TRANSC

RIPT



CA Okay. And then the next one is one of the posters that's been mentioned last week, a Peek is a Breach. So was that your 2017 campaign?

W That's correct. CA And you've mentioned in there that it can result in a criminal conviction and go

beyond disciplinary. What else as part of that campaign did you have? You've got posters.

W As I said, we've got posters, there’s emails, there's screensavers, there is the tool 10

box talks, there's the videos. In addition to all of this, I'm not sure if it was back in 2017, but Ethical Standards Unit goes out and does periodic training face-to-face with all staff, as many as they can get given the spread of geography that we're represented in. So there's a series of different interactions, if you like, that addresses privacy and TICA, TRAILS access.

CA So this A Peek is a Breach, that was a campaign run on a quarterly cycle? W It was run for a period - I can't remember the dates exactly, but it's run for a

large percentage of that time. You know, given that, you know, people get a 20 little bit desensitised to the same old poster, so we try and refresh that periodically, and so that's when we went into the 2018 campaign.

CA So that next document, I believe, is the one for the 2018 campaign, is it, or not? W So the 2018 campaign was about What a Peek will Cost You. CA Sorry, they're swapped around. So it’s the next one. W Yes, so the one you see there is the '19 campaign that we're currently running. 30

So the '18 campaign was around What a Peek Will Cost You. So this is looking at the impacts or the consequences to staff not knowing the rules of engagement, if you like. And that's around it could cost you your employment, it could cost you your health and well-being, reputation, future employment, stress, money or a criminal record. And it starts to highlight some of the consequences of inappropriate behaviour.

CA And then for 2020 you're still working on it. Or did you want to go back to- W Sorry, 2019, the year we're currently in? 40 CA It says 2020 campaign is being developed. W So we haven't spoken about the- CA Yes, okay.

UNPROOFED TRANSC

RIPT



W Sorry, they're out of sequence. So the campaign we're currently running is around, again, building on the previous campaigns, it’s talking about if you see it, hear it, find it, know it, you’ve got to report it. So there is an obligation on all employees to be vigilant in regards to all of this.

CA Just with that one it doesn't mention criminal on that one. I know the other two

did. It’s not a current campaign. W I suppose a breach of Code of Conduct, we talk about unlawful invasion of

privacy. I suppose it’s- 10 CA Oh yes. W Again, these are all complemented or supplemented with videos, not only from

myself but from my senior leadership team who are out there making sure that people are aware.

CA And then after that you've got a series of, is it emails? W So they're the templates of the emails that go out from me and also my various 20

regional directors under their signature picking on a specific topic out of that. So someone will talk to the see it, someone will talk to the hear it and so forth. And so there's copies of those sort of emails that have gone out as well.

CA And then we might just touch on before we go into some of the other trainings

of it, the warning, you provided two warning screens yesterday to the Commission.

W The warning screens. You mean the login screens? 30 CA Yes. W Yes, yes. So there's two login screens, sorry. PO Ms FOTHERINGHAM, do you want to tender that collection of posters and

training material? CA Yes. PO I'll tender those as Exhibit 146. 40 ADMITTED AND MARKED EXHIBIT 146 W So I have a USB stick that has all the collateral, plus the videos and so forth.

Would you like that? CA I don't think we need – I think there's quite a lot here.

UNPROOFED TRANSC

RIPT



W Okay. CA When we’re sort of comparing you with other agencies. So if we just look at

the two logon screens. W Yes. CA Yes, I’ll show you those. Oh you’ve got them already. W Sorry, you want the emails? 10 CA I tender those documents as one exhibit. PO That's the login screens, is it? CA Yes, two login screens. PO Exhibit 147. ADMITTED AND MARKED EXHIBIT 147 20 CA We've got them there anyway, Mr MAGOFFIN, for you. W Sorry? Thank you. Sorry, I've lost my – hang on a sec. CA We've got copies there if you just wanted to use our ones. W Thank you. Sorry, I had it. I can't find it. Okay. CA Yes, so did you just want to walk through those two screens? We've got the 30

blue one first. W So the blue one is when you're logging into the corporate system, so that's your

daily login just to get into TMR's corporate site. And it talks about before accessing a system you must agree to comply with the Queensland Government, the Transport Portfolio and your relevant department's policies, standards and Code of Conduct. And goes through some of the other elements of that. So, again, it’s sort of highlighting the Code of Conduct in regards to if you accept to log into those systems.

40 CA And then the second one. W So the second one is if you have access to TICA/TRAILS. On the logon screen

there it talks about the data contained in this system is private is confidential. CA Okay. Now, just going through training, again this is using the response

material providing the questionnaire. So if it's any need for clarification, please, let me know. I'll just show you, we’ve just collated it on to a little list.

UNPROOFED TRANSC

RIPT



W Okay. CA If you could just speak to it. W Thank you. CA I tender that document. So in the response material leading up to the hearings,

it appeared that there were 84 different training options offered; are you aware of that? 10

W Eighty-four, I'm not sure, no. CA Okay, but around that figure, that sort of- W I couldn't- CA It’s quite a number. W Yes, it is quite a number. I couldn't answer that. 20 CA And 35 of them are mandatory. Are you aware if you have some training which

isn't mandatory? W We have mandatory training, yes. But that's more specific to the roles than it is

a blanket. So there's mandatory training, so I have to go through mandatory training every year as well.

CA And 21 of those options were in-person training as opposed to online? Or you're

not sure about them? 30 W I'm not sure of the specifics of that. Our online training tool called Accelerate,

it manages all those different modules that we have to adhere to. And I'm sure there's other training out there, but I'm not aware exactly the number.

CA And the response material said that for 30 of the training options there wasn't a

record of participants kept and those were for online ones. Are you aware of some of the online options where you don't need to login who you are and there's not a record kept?

40 W I'm not sure if the records are kept. The mandatory components of the training

are logged and recorded. CA Yes. W The recommended ones, I assume would have a log of completion and so forth

from there when you've done them. And general learning, I'm not totally

UNPROOFED TRANSC

RIPT



familiar with the audit trail of those. But I assume that if they're on the Accelerate system that that's all logged and managed through there.

CA And then if we just look at the list that we've collated. So the first one, Access

to Customer Records eBrief every two years. So that's mandatory? W That's right. CA And assessed? 10 W That's right. You have to pass an assessment online to pass. CA And then there's a participant’s record kept? W Absolutely, yes. Through your login, yes. CA And then, which way would you go ethical conduct training. That's annual.

And the same mandatory and assessed? W That's correct. 20 CA And then TICA basics, that's upon initial use? W Yes. CA And then CSB. What's CSB? W Customer Services Branch. CA Staff responsibilities training every two years. Again mandatory records kept? 30

Assessed? W That's correct. CA Peek is a Breach periodic, that's what we’ve just been talking about? W That's all the same material. Sorry, the awareness material. CA Yep. And then the next one is probably the same, tool box talk? 40 W That's correct. CA Ethics in TMR. W And that's where I spoke about Ethical Standards going around periodically

around the State delivering their training. There is a - I'm just trying to find it, I think there is an online component to that as well. It’s just not jumping out at me. But again all of these attendance are logged as part of the attendance sheet.

UNPROOFED TRANSC

RIPT



CA And then Privacy in a Nutshell periodic? W Yeah, that's something I'm not aware of, but I can only assume that it’s out there

if someone has told you it is. CA So with respect to misuse of information on a database, have you got any

specific information technology training that goes through what unauthorised uses and provides information about the range of possible sanctions disciplinary and criminal? 10

W I'm not sure that it is prescriptive in the sense of saying what the outcomes of

the disciplinary action could be. A lot of the course outlines through the online training, like access to customer records, talks about the Privacy Act 2009 and walks you through access to customer records, eBriefing, and some real case studies in regard to that. So that may give them a flavour of some of the consequences of those cases. So if you go to the CSB module around staff responsibilities, that course is about the Code of Conduct, what it looks like in their centre and a reminder of their obligations under the code. It includes information and activities on fraud, corruption, business processes and access 20 to customer records and reporting. And then it walks you through a number of scenarios there. And there is an assessment at the back of that that you have to pass.

Which Way Would You Go is another online mandatory program and it talks about that ethical standards as regards to public service employees and we're obligated to behave ethically at all times. And walks through a number of different content there to allow the participant to make choices, and that's part of the assessment at the end of the day. So, again, enriches their comprehension and understanding around their roles and responsibilities, so when it comes to 30 that.

CA Thank you. Now, the next question that your agency wanted to talk about again

today was, do you other than in the Access to Customer Records Policy, so that was tendered as an exhibit previously.

W Yes. CA Reinforce the staff that when they logon, use their password that their use is

being monitored. And first of all I'll tender the single page list as an exhibit. 40 PO Exhibit 148. ADMITTED AND MARKED EXHIBIT 148 CA And then I will show you the policy that- W Sorry, have I got that to hand, have I?

UNPROOFED TRANSC

RIPT



CA We have a copy for you. W I'm not following the script. CA It is use of ICT Services, Facilities and Devices Policy. W I don't appear to have that. CA We have a copy for you. 10 W Okay. That would be great. CA I tender that document. PO Exhibit 149. ADMITTED AND MARKED EXHIBIT 149 CA Did you want to speak to that document with respect to the question you wanted 20

to elaborate on? W I'm not exactly sure the question I was asking. CA With respect to this document, I believe that it outlines that login is monitored,

and it’s use and the usage of all usage is a condition of employment. LR Sorry to interrupt, I just thought it might assist, Commissioner. In respect of

these questions generally the responses that have been provided were hopefully of assistance to the Commission because they were questions that were put to 30 either the D-G or to the CIO, and we thought it would be appropriate to provide more fulsome answers from the Department. But they don't necessarily fit within the ambit of Mr MAGOFFIN.

PO Yes, I understand. LR So to the extent that some of this material being put to him it’s not necessarily

within his expertise. PO Yes, thank you, Mr Humble. Mr MAGOFFIN, I think you're making that point 40

as you go. If it is outside your area of expertise or knowledge feel free to tell us that. Obviously I don't expect you to be right across all of this, but where you can comment authoritatively then do so as well.

W Thank you. PO Is that clear?

UNPROOFED TRANSC

RIPT



W Yes. CA There's only one more short question and then it moves on to a discipline

question, so hopefully we're at the end of it. So, yes, so that was the point with this document, I believe, about the outlining to staff that the usage is monitored.

W That is outlined, yes. CA Now, just moving on to disciplinary matters, I'll go through some case studies

shortly, but if we could speak more globally about discipline. In relation to the 10 decision-making processes with respect to discipline, are there any factors that are used by way of determining the threshold for instituting disciplinary proceedings when there's a misuse of information?

W It might help if I go through the process of- CA Yes. W Yep. Which I prepared here. So I appreciate the CCC’s interest in the

disciplinary process and have prepared a response to assist the CCC in 20 understanding in a general sense how matters such as these arise within TMR. The progress of an information misuse matter is as broadly as follows: the suspicion of misuse may be raised via a customer complaint, a public interest disclosure, for example, where another employee may report areas of concern, and/or exception reporting from analytics such as the unusual after-hours access. An initial management evaluation may take place within the relevant business area, for example, where the analytics generates an exception report which requires more scrutiny. For suspicion of information misuse matters a referral is then made to the Ethical Standards Unit who assess the matter. ESU will then refer the allegations to the CCC. 30

The CCC will assess the referral. For matters such as these it is ordinarily the case that allegations will be referred by the CCC back to the ESU for investigation. At that time the CCC may recommend that the allegations be referred to QPS. The CCC may also require that the Department report back in relation to the outcomes of the investigation. Once a matter is referred to the ESU for investigation by the CCC, the ESU will investigate the allegations, providing the decision-maker, such as myself, with the Terms of Reference for the investigation. In some cases an external investigator will be appointed by ESU to conduct the investigation. 40 Following the investigation, a report will be issued by the ESU to the decision-maker which makes findings as to whether, on the balance of probabilities, the allegations have been substantiated. The decision-maker will review the investigation report and determine whether to accept the findings. Where allegations are substantiated the decision-maker will then issue a show cause which outlines the findings of proposed sanction and invites the employee to make a submission.

UNPROOFED TRANSC

RIPT



The disciplinary decision is made by the decision-maker having regard for the full circumstances of the case, including any submissions made by this employee. The decision-maker also will have regard to any advice from the CCC and the ESU and will consider whether a QPS referral should be made. The decision-maker will make any decision to refer a matter to the QPS and ESU will facilitate that referral, together with any supporting information such as an investigation report. If a matter is referred to the QPS, the QPS will determine whether criminal sanctions should be pursued. I'm advised by Ethical Standards Unit that eight information misuse complaints have been referred or 10 are in the process of referral to the QPS over the last four years. In relation to the complaints from the 2018-'19 year I'm advised there has been three information misuse complaints subsequently referred to QPS. In addition there is a further two matters for referral in progress. In my role as general manager of the customer services branch I routinely act as a decision-maker in matters such as these and I can provide the CCC with information in relation to the disciplinary decision-making. However, cannot provide insight into Ethical Standards responsibilities of investigation practices or QPS referrals. These are aspects that are independently managed by Ethical Standards Unit to ensure 20 integrity and consistency of the process.

CA Thank you. So just turning to what you touched on there with the Queensland

police referrals, it is the Commission's view that the criminal avenue should be looked at first, and then the disciplinary; is that what happens with you?

W Typically that's what happens. We wait for a response back to QPS as to how

they want to handle the case. If not they’ll refer it back to us and then the process takes over where I'll go through a show cause process with the subject officer and go down that path. 30

CA And with the Queensland Police Service, for the 2018-2019 year, so finishing

30th June this year, you had three referrals? You made three referrals; is that correct?

W Yes. CA And how many of those three referrals are outstanding? W I can't comment on that. That's a question for ESU. 40 CA Because you did provide us with a table providing those answers. Have you got

that table there or did you want to be provided with a copy? W Are you talking to this table? CA You sent that through today or you agency did.

UNPROOFED TRANSC

RIPT



W Yes. Not that one, no. I really can't answer that. I don't appear to have that. Thank you.

CA So that was provided by Department of Transport and Main Roads to us today.

And it's the list of matters which have been referred to the Queensland Police Service in the last four years, the four years that have been the subject of our request for information. So from the 2015-2016 financial year, to the 2018-2019 financial year. And in there you will see it shows the matters with 18 in front of them, and 19 in front of them.

10 W Yes. CA And says their status. So is it correct that for the matters from the 2018 year

itself there are two, and that they are both still pending with respect to an outcome from the Queensland Police Service?

W According to this document that's what it shows. Again, this is not part of my

jurisdiction, if you like. This would be managed through the Ethical Standards Unit.

20 CA Just wait one moment. So I’ll just go through so you can say whether or not

when you're looking at the table. So there's two matters there with "18" in front for the reference numbers; is that correct?

W Yes. CA And they are showing in the column for QPS outcome as pending. W That's correct. 30 CA And there are three matters with "19" in front of them? W Yes. CA And two of them are showing as “pending”. And the other one pending in that

it specifically says “QPS obtaining statements”; is that correct? W That's correct. CA Now, would you like to go through the factors that the Department of Transport 40

and Main Roads considers with respect to the disciplinary decision making process?

W Sure. The various focus that we take into consideration through the process,

these include the seriousness of the allegations, the detriment, the actual – or, potential to any individual or group as a result of the breach, any financial or personal gain, nature and responsibilities of the employer's role, including

UNPROOFED TRANSC

RIPT



experience, seniority position of high trust, whether the incident is isolated or ongoing, any submission that is made by the subject officer.

There are thresholds for imposing higher penalties in the cases of unauthorised access and disclosure of controlled information using a computer, specifically termination or demotion, including post-separation declarations which involve situations outlined as follows: where an employee has personally benefitted from disclosing the information; where the employee has directed another staff member to inappropriately access information on their behalf; where an employee has disclosed personal information to a third party. 10

Situations of a lower level penalty may be applied would include where the employee has not personally benefitted from the accessing or disclosing of the information or an employee accessed or disclosed information concerning a member of their own family, whether that family member has a genuine reason for not being able to access the information themselves, for example, the person has a disability. It should also be noted that if an employee has been issued previous disciplinary penalties on an unrelated matter, it may have an impact on the disciplinary penalty imposed on any future matter.

20 CA Thank you. We'll just go to the case studies now. So the first one I called Letter

1. I’ll give you Letter 1 to introduce it. W Thank you. CA I tender that document. PO Exhibit 150. ADMITTED AND MARKED EXHIBIT 150 30 CA Now, in that matter, did you just want to speak to that matter, first of all, then

I'll ask a couple of questions, or do you want me to go through it? W I think from memory this was quite some years ago, so I'll probably just take

questions. CA All right. So this involved a misuse of information to benefit another person. W That's correct. 40 CA And it involved use of accessing the database to invalidate, so it was to modify,

the subject officer's brother-in-law's licence application? W That's correct. CA And also involved what we were talking about before, conflicts of interest, so

there is a failure on behalf of the employee to disclose a conflict of interest?

UNPROOFED TRANSC

RIPT



W That's correct. CA And it wasn't detected through a proactive audit. Can you talk about how it was

detected? W I think this case goes back quite some years, so my vague memory of it was that

it was reported through another staff member who was aware of the interaction there and deemed it inappropriate, and then it came to my attention, so we had it investigated. 10

CA And the result was a transfer at level? W That's correct. CA And the employee held a supervisory and mentoring role for other staff

members? W He had a supervisory role. I suppose you could assume he had a mentoring role

as well. 20 CA So when you were talking about those factors, one of them being the seniority,

this employee held a relatively senior position? W That's correct. CA And the punishment was transfer at level? W Yes. 30 CA So went off to another part- W Part of the business. CA -to again supervise more staff? W No. There’s no supervision in his current role or any role since then. CA And was this matter referred to the Queensland Police Service? 40 W I can't answer that. I don't have a memory of that. Again, this was quite some

years ago, and which pretty much started me on the journey of rolling out these campaigns to make people aware of their responsibilities.

PO Mr MAGOFFIN, are you implying by that that since then, over the ensuing

years, the Department's attitude towards these matters have become more robust, more serious?

UNPROOFED TRANSC

RIPT



W Absolutely. PO Taking them seriously. W Absolutely, Commissioner. And this is, sort of, the journey we've come along.

We’re – I might say we're somewhat immature back in 2012/'13 in regards to understanding our roles and responsibilities, in essence, so hence the training and the awareness campaigns that we've been running concurrently since then to try and heighten the awareness of people's responsibilities and the accountabilities, and more so the consequences of their actions as we go 10 forward.

So as I mentioned about, you know, the various lines of defence earlier about, you know, the technical systems, the business systems, but also the people and culture, that's the framework that we've been on this journey with.

And I'd have to say, it's quite robust now, in my opinion, and it’s somewhat more mature than we have been in the past. So I'm confident that – and it was part of my approach to decisioning case matters was to take away the reason or excuse that the subject officer wasn't aware. Well, through all of these 20 mechanisms that we've got in place, it would have to be an extraordinary event that that person wasn't aware of their responsibilities and accountabilities when it comes to this.

So, hence, when I'm coming back, I don't have the date here, but I would sense this could be four plus years old. At that time, the response, from memory, from the subject officer was trying to have a good customer experience with his brother-in-law and resolve the problem. Unfortunately, he was naive in the sense or unaware of the sense that he was actually breaking the Code of Conduct and, therefore, was putting himself in a difficult situation. 30

So through all of that, and in my deliberations over this case, from memory, was around he probably had some validity in his – not necessarily knowing that he was breaching any protocols and so, therefore, I chose to move him aside away from that role, and he had no supervision of any future staff since then.

CA So as part of the material that your agency provided to us last night, for today,

was a table with the identifying – particular of the matter, then the description, and then disciplinary factors considered in the outcome.

40 And for this one, the description was, as I've said, that there was unauthorised accessing database for the brother-in-law for the purpose of invalidating a licence application. And then under that it says, “Had it been conducted by the brother-in-law through the ordinary service channels, the transaction itself would have been lawful. And there was no personal gain for the subject officer or loss to TMR.” So are those factors that are taken into consideration with respect to, one, should it be a police referral, and, two, a disciplinary action taken?

UNPROOFED TRANSC

RIPT



W In this particular case, from memory, it was around that the subject officer didn't

gain anything from it. I don't necessarily think he was fraudulent in his activities, he was just trying to give his brother-in-law a good customer experience, if you like. A referral to police, I can only assume didn't seem to be a course of action I thought was relevant to this particular situation. But again, we've matured quite considerably in this-

CA We will go through some. 10 W Sure. CA I’ll just start on this one W Yes. CA And we’ll go through all the others that you've been notified of. So it says here

under the disciplinary factors considered section of your table you provided us, is that the subject officer had previously been trained, access was by way of direction to staff members. Failed to disclose a conflict of interest. Access was 20 authorised by the customer. And there was no financial gain as factors-

W That's right. CA -that you consider. W Yes. CA And that it was an honest mistake of processing in an attempt to solve the

customer's query. 30 W That's it. CA And otherwise a diligence performance of duties. And then you looked at the

impact on the employee who is a husband and father. W That's correct. CA And then outcome, all allegations were found to be substantiated to transfer at

level. 40 W That's right. CA All right, we'll move on to the next one. I'll show you another letter, I'm calling

it Letter 2. W Thank you.

UNPROOFED TRANSC

RIPT



CA I tender that document. PO Exhibit 151. ADMITTED AND MARKED EXHIBIT 151 CA So you're familiar with this one? This involved several staff members- W Yes, I am aware. 10 CA -five. W Yes. CA And it involved access to TRAILS for the purpose of preparing court documents

and noticed that another employee's licence was under suspension and then that information was disclosed.

W That's correct. 20 CA Would you like to talk about the disciplinary factors considered in that matter? W So, again, this was some time ago, some years ago, but this was around, if you

like, a team of people who became aware of this, decided to take it under their own volition in regards to looking up the system to see if that was actually factual. So there was several of them implicated in that, you know, if you like, guilt by association because they were all standing there doing that, and they also asked another member of another team to access the system as well.

So there was a, sort of, a collage of errors, if you like, or incidents there where 30 these people had, through their own sort of, you know, judgment, thought that they were doing the right thing by getting evidence around whether it was factual or not.

So taking all those aspects into consideration, and there's always a myriad of different things to comprehend in any of these cases, the seniority of the subject officer, you know, the seriousness of the matter. It was an honest mistake which I deemed, out of the investigation, that these guys were genuinely trying to, sort of, do the right thing, if you like, but unfortunately by not being aware of their actions were actually breaking the Code of Conduct. 40

The submissions from there, from the subject officers showed that they were, you know, very remorseful for their actions and understanding the risk to the Department and the public. All the allegations were found to be substantiated and the primary subject officer and his co-worker received financial increment penalties. And the remaining officers were reprimanded.

UNPROOFED TRANSC

RIPT



CA So this letter here which we've tendered, in relation to it, there is a reprimand. And the employee was a senior transport inspector with a supervisory role?

W That's correct. CA Was reprimanded. And continued in that supervisory role? W That's correct. CA Was there referral to the Queensland Police Service for this individual? 10 W Not that I can remember. Again, as I keep saying, we're a lot more mature in

the space than we were a number of years ago, and at that time, you know, I think these were just genuine mistakes and error of judgment in regards to what they were trying to do. So referral to police probably wasn't on my radar at that time.

CA Okay, we'll move on to another one. I'll show you Letter 3. W Thank you. 20 CA Now, this involved two employees. I tender that document. PO Exhibit 152. ADMITTED AND MARKED EXHIBIT 152 CA This involved two employees where one was involved – not the one we have

the letter. The letter is in relation to the employee's colleague. But one of the employees was involved in a road rage incident. 30

W Yes. CA And telephoned the employee. We've got the letter pertaining to it. And this

employee was asked to access the records of the other motorists involved in the incident, the road rage incident. .

W Yes. CA Which she did. So she acts – or he/she accessed and disclosed the information 40

to the colleague. And then that was used to telephone the member of the public involved in the road incident. And that person was abused over the telephone, which led to a police investigation.

W That's correct. CA And the employee we're talking about, the one who accessed and disclosed the

information, received a pay point reduction for 12 months. Was there a police

UNPROOFED TRANSC

RIPT



referral in relation to this employee for that access and disclosure of information in the circumstances of knowing that it was given to the fellow employee in a road rage incident?

W My limited recollection of this was that it was referred to police. CA And what was the outcome? W I can't remember the specifics of the case, but one could only assume that if it’s

come back for me to decision, that the QPS had no interest in the matter and 10 referred it back to me for decision.

CA Do you consider that a reduction in pay point for 12 months was a disciplinary

outcome fit for this particular type of access and disclosure involving harm, physical - sorry, emotional harm to a member of the public?

W It is unfortunate that this situation arose. The primary subject officer was

terminated because they're the ones that actually instigated both the contact with this subject matter -- officer, and this person was, sort of, again, an error in judgment in my eyes. 20

CA We're talking about misuse of information under the Criminal Code section

408E. This involved not only access, but also disclosure in circumstances where there was a real risk of physical and/or emotional harm to a member of the public.

W Yes. I appreciate on the face of things what you're advocating. There are

extenuating circumstances with all of these, with all of these cases. And the challenge with all of this is for me to be clear in my mind, not so much what I believe, it’s what I can prove. And in this case here, from memory, I don't think 30 that this person had anything to gain from this. I think she was, she I think it is, was somewhat naive in regards to providing this information to her colleague and wasn't aware of exactly what that colleague was going to do with that information.

She was extremely remorseful in regards to the situation. And I felt on this occasion that, you know, a reduction in increment for 12 months was certainly penalty enough given that the amount of remorse that this person displayed throughout this process. These are people who, I don't know all of their financial situations, but they may be single income families, so a reduction in 40 increment is significant to some people.

CA And I'll just show you Exhibit 22, Access to Customer Records Policy from the

Department of Transport and Main Roads. I'll just check that's the correct document.

W No, I don't think that's it.

UNPROOFED TRANSC

RIPT



CA Exhibit 21, sorry. Just go to the last page of that document, Appendix A -- second to last page, sorry. So you've got some de-identified case studies there-

W Yes. CA -which are helpful for prevention. However, one of those three case studies is

the one we've - is the road rage incident we've just been talking about, number one.

10 W Yes. CA Wouldn't you agree that it's not the best example to set to prevent your staff

from misusing information where you've had access and disclosure risking physical and emotional harm to a member of the public in a road rage incident, and there's just -- the outcome is just a pay point reduction? And there's no mention of any referral for that employee to the Queensland Police Service in that case study either. Don't you think that you could have picked one where there was a bit of a stronger stance taken on discipline as a preventative function? 20

W Possibly. Again, I suppose fortuitously we don't have that many to select from.

So maybe that was part of my thinking. With regards to is it a great case study, well, possibly in isolation one could find a better way, or a better case to put there, but these case studies are only one part of our approach to the people and culture that I talk about in regards to the plethora of other activities that we do in the space. So one case study in isolation, one could argue whether it is good, bad or indifferent. My view is that we're trying to take all our staff on a journey in regards to understanding their responsibilities and accountabilities. And as I keep saying, we're getting quite mature in this space, and so these campaigns 30 are probably overtaking some of these older case studies.

PO I suppose it might have been beefed up, as it were, by reference to what you said

before, about other employee, also a DTMR employ being terminated. W Absolutely. And again, you know, we try and de-identify and desensitise these

case studies so I don't have 2,000 people doing a witch hunt wondering who it was. I’d rather them just get on with their day job. So it may lose some of the firmness or the flavour that you’re intimating here, but, again, these are just one of many tools that we use to highlight the roles and responsibilities. 40

CA We move to letter number four. W Thank you. CA So this one involved repeated -- I tender this document. PO Exhibit 153.

UNPROOFED TRANSC

RIPT



ADMITTED AND MARKED EXHIBIT 153 CA This involved repeated access to the family member file/record. W That's correct. CA And the position of the employee was a principal customer service officer? W That's correct. 10 CA And the purpose was to provide the demerit history to the family member, the

son? W That's correct. CA It was intercepted by way of a proactive monitoring of outbound emails? W That's correct. 20 CA And the result was a reprimand. In the table that you have provided for the

description for this yesterday, you say, “There was no personal gain for subject officer or loss to TMR in this matter.” So was that a consideration in whether or not to refer to the police and what type of penalty, disciplinary wise?

W Absolutely. Again, there's a number of factors to take into consideration in any

of these cases. And none of them are ever black and white. There is always extenuating circumstances that you're not aware of even until in the show cause process where the subject officer responds to the allegations presented.

30 So in this case here, it was a mother who was trying to sort her son's business out. Again, error in judgment. She had no - she was getting no benefit out of this other than trying to sort her son's situation out. So once it was identified – these are good honest employees who have an error in judgment. So she was extremely remorseful. She had a very strong work history with us. Whilst the allegations were substantiated, we referred the matter to the CCC, who referred it back to us and I made a judgment call on that.

CA Did you refer this matter to the Queensland Police Service? 40 W I can't answer that. I don’t – I’m not aware of it. I can only assume if it’s not

in my notes it didn't happen. But I can't answer it. CA And then the last one, Letter 5. W Thank you.

UNPROOFED TRANSC

RIPT



CA Involved the staff member accessing TRAILS/TICA system for the purpose of conducting transactions on behalf of her friend, an ex-employee’s husband-

W That's correct. CA -and grandson without them being present? W That's correct. CA And one of the factors that you considered in disciplinary action was that you're 10

unable to prove that access was not properly authorised by the customer? W That's correct. The CCTV couldn't validate whether the power of attorney

document was actually tabled or not. CA And there was no personal or financial benefit for the employee? W That's correct. CA But you also noted that there was a failure to declare a conflict, personal 20

relationship- W That's correct. CA -was substantiated. And the outcome was a managerial action? W That's correct, yes. CA I'm taking it you didn't refer this one to the police? 30 W No, I didn't. When we investigated this, and again just going on memory, at

times it's hard to substantiate the allegation if you don't have any hard evidence. So whilst I might believe what may have happened, if I can't prove it then it is very difficult for me to decision otherwise. Referral to police in this situation I didn't deem appropriate given that there was no fraudulent activities that I could see or any, I don't know, any benefit to any of the parties other than not following the procedure.

CA Can you see a theme in the four of the five case studies that we've just discussed?

The theme I can see is that there are staff members who are accessing the 40 personal confidential information contained on the Department of Transport and Main Roads' database not for an authorised business purpose-

W Yes. CA -but for providing assistance and benefit to their friends and relatives, and they

are not receiving any criminal punishment, and are ranging from managerial action to transfer at level, reduction in pay reprimand. Could it be that that

UNPROOFED TRANSC

RIPT



engenders a culture within the agency that it's somewhat acceptable and nothing much will really happen if you help out your mate?

W No, I don't agree with that synopsis. I decision a lot of cases on any given time,

of which a number is more around behaviour than it is around system access and so forth. In those cases, a percentage of those cases end up in termination. So what you're inferring-

CA Termination for what, sorry? 10 W For more behavioural aspects rather than system access- CA And what- W So in other cases. CA would that be? W So what I mean by that is that I will make the hard decisions when I have the

supporting evidence and the understanding of the case in general. To look at 20 these cases here in isolation, you need to understand the full investigation, the full body of evidence that I had before me and the intent of the officers of what they were trying to do at that time.

I don't think it’s a fair judgment to say that that's somewhat light on, and I don't think it represents the culture that we have within the organisation in regards to system access or the consequences and accountabilities of their actions as we go forward. As I said, I've decisioned a number of cases over the years of which have ended up in termination, so it is not as if I won't make the hard decisions, but again it’s not what I believe may have happened, it’s what I can prove has 30 happened.

So none of these cases are as black and white as, you know, a letter may infer. There is certainly a lot more other mitigating circumstances that I need to take into consideration.

CA All the ones we've just been through you substantiated all of the allegations; is

that correct? W That's correct, but then- 40 CA Thank you. W Okay. CA Now I'll just show you Exhibit 11, which is section 408E of the Criminal Code

Okay, so you'd be familiar with that section?

UNPROOFED TRANSC

RIPT



W Yes, I am. CA So you'll see there under section 408E(1) it is an offence, and there is a criminal

penalty of up to two years for one of your employees accessing, using their password.

W Yes. CA Let's use TRAILS, TRAILS database. That's it. If it’s not for a business

purpose, which is the consent of the controller, the controller being your 10 agency?

W That's correct, yes. CA And then if you go to subsection (2), that's where there's an aggravating factor,

making it more serious. And the penalty rises to five years. W Yes. CA And that is where there is a detriment or damage, or gain or intend to gain a 20

benefit. And I've heard you mention “benefit” a lot while we were talking about these case studies, saying how the employee didn't gain a benefit.

W That's right. CA Now, I'll just show you section 1 of the Code which is Exhibit 108. So you will

see there that “benefit” is defined down the bottom. W Yes. 30 CA And it is a non-exhaustive list, including whether or not there's any inherent or

tangible value, purpose or attribute. So the net is cast very wide there. W Mmm-hmm. CA Now, I'm going to show you a decision that was made in the Magistrates Court,

at Brisbane. It's a series of over three days there and, just for completeness, it did go up to the District Court with respect to an issue that doesn't pertain to what we're discussing, but just for completeness or for our Form 1 document, which I'm going to show you. 40

W Thank you. CA I tender that document. PO Exhibit 155. ADMITTED AND MARKED EXHIBIT 155

UNPROOFED TRANSC

RIPT



CA So this was a decision of the Police v Daniel Denis BANKS. The transcripts I've

given you are from 15th September 2017. The 7th November 2017. There being two from there. And then 14th March 2017, that one.

PO Is it ‘18? 14th March '18 or '17? CA '17. And that's again at the Magistrates Court. I believe I might have said the

District Court for the last one. 10

So if we just go to the first one, on the second page, it talks about why the defendant's there. And the first paragraph there were 23 charges between 31st October 2013 and 30th October 2015.

The second paragraph shows that it was a police officer accessing QPRIME database. And it was access -- he was obtaining information about a number of people, including his wife, his wife's former partner, and associate and some others. Looking up registration numbers and addresses. So that's the sum of what he was doing.

20 W Sure. CA And then down the page, at the bottom on page 2, it says the exhibit 2 outlines

the particulars of the charges. And then you go to page 3. And I'll just let you read through that italic section. And you'll see at the bottom of the italics section that the benefit was an advantage, namely knowledge.

W Yes. CA And then if we just go to page 6, at the top, that this defendant was charged 30

under section 408E(2), that he had obtained a benefit. W Yes. CA And then if we go to the next transcript, which was from 7th November, 9.02am. W Is that in here? CA Yes, they're altogether. 40 W Oh, yes. CA At page 10. Yes? W Yes. CA I'll just read this out:

UNPROOFED TRANSC

RIPT



“I make this very general submission that both my client's case and the case of Higgins has been a trigger, adopting my learned friend's word, to overcome a cavalier attitude that may have existed within the Queensland Police Service. There has been (a) since these two cases, there has been a clear, largescale public awareness campaign by the Crime and Corruption Commission, the Queensland Police Service and the Queensland Police Union of Employees themselves to change 45 a cultural attitude within the Queensland Police Service.

Now, that cultural attitude, your Honour, in my submission, related from a change from information security where it was trained, installed, made known 10 that information security was paramount and that has been the case for some time. It has not been the case until, if I could identify the trigger of the appointment of Mr MACSPORRAN as the CCC chairperson, that there has been a deliberate change from not just information security but information access itself.”

W Yes. CA And then the last part of that same day was on 7th November at 9.48am. On the

last page, 6, at the top “deterrence” is mentioned, and then the penalty being 20 $4,000 for that criminal offence.

W That's correct. CA I'll just show you Exhibit 89. W Thank you. CA Are you familiar with that document, Prevention In Focus by the Crime and

Corruption Commission from May this year? 30 W No, I'm not. CA On page 3. You see "Criminal Prosecution" there? W Yes. CA And the document is talking about improper access to public sector databases.

It says: 40

“Where computer hacking and misuse by a public officer results in a breach of a citizen's privacy, the public interest will almost always require prosecution. Agencies who detect such conduct by their staff should ensure that criminal prosecution is seriously considered - this will generally require the matter being referred to the QPS as a criminal complaint.”

W That's correct.

UNPROOFED TRANSC

RIPT



CA So as you'll see, the types of behaviour that you are providing excuses and reasons for are matters that do proceed in other agencies through the courts.

W I can't give an opinion on that. I don't know those other cases other than just

what you've told me there. Again, this is May this year, so I think we're – you know, some of the cases you're talking about in my space are several years ago. Drawing a comparison between my cases and these, I can't offer an opinion.

PO And I think you've said, Mr MAGOFFIN, if I’ve understood you that your

system has now matured and your approach to these matters has matured. 10 W That’s correct. PO And the Department now has a policy of, consistent with other agencies, of

considering criminal action first? W That's correct, yes. PO And then whether that happens is up to the QPS, but at least you refer matters

in the first instance that meet that test and leave it with them to decide? 20 W Absolutely. And thank you, Commissioner. As I refer back to the statement I

spoke about earlier at the start of this part of the questioning around we manage disciplinary matters within TMR, and I spoke about how we refer through to Ethical Standards who refer through to CCC, and then back into QPS, so that pathway is well and truly there now. I really can't comment on those cases you've put before me today, but other than to say that they're our processes and how we go about our business today.

CA Thank you. I don't have any further questions. 30 PO Thank you. Mr HUMBLE? LR Thank you, Commissioner. Just a few questions.

You were taken to what was described as letter number three, Exhibit 152, Mr MAGOFFIN.

W I don't have them anymore. 40 LR Mr MAGOFFIN, I don't know whether you recall this, but in that case you were

the decision-maker only in respect of the primary subject officer? So that decision seemed to have been made by you as the decision-maker in respect of the primary. And in respect of the co-worker, you were not the decision-maker.

W I can't recall that, I'm sorry. . LR Well, if I put it to you that that is the case-

UNPROOFED TRANSC

RIPT



W Okay. LR -and that, in fact, as the determinant of the primary perpetrator, you made a

decision that it be referred – the matter be referred to the Queensland Police Service?

W Yes. LR And that you terminated the relevant employee? 10 W That's correct. LR Thank you. PO Mr HUMBLE, it would probably be helpful if you have that information – do

you have that in a departmental record or a note or? LR We do. 20 PO If you wish, we can tender that as part of that case, Exhibit 152. It would

probably be helpful, I think, for us to have those circumstances fleshed out. But you don't need to worry about it today, just produce it to the Counsel. .

LR Yes, we will provide it, Commissioner. Thank you.

If I could ask the witness be shown, please, Exhibit 19. W Thank you. . 30 LR Now that are some statistics that were prepared by the CCC. Are you aware,

Mr MAGOFFIN, that the Department's prepared an analysis of those statistics? W Yes, I am. LR And I would ask that that analysis be handed up and tendered, your Honour.

That's been provided. PO What was the exhibit number for the data that we prepared, did you say? 40 LR Nineteen. PO So perhaps we should make your analysis part of 19 to keep them together. LR Thank you, Commissioner.

Mr MAGOFFIN, you were taken to a table showing some QPS referrals.

UNPROOFED TRANSC

RIPT



W Yes. LR And I think it was your evidence that the QPS referrals are managed by the

Ethical Standards Unit. W That's right. LR And that the ESU is independently managed in order to maintain its integrity? W That's correct. . 10 LR So you personally have very limited personal knowledge of the outcomes of

those referrals? W That's correct. Unless it comes back to me to decision. Thank you. LR Could I take you to Exhibit 155, the Magistrates Court decision, which you were

taken to. That's the first time you've seen such document. W Absolutely, yes. 20 LR No prior issue was raised with you or, indeed, with the Department in respect

of that as far as you're aware? W That's correct. LR And I think it is the case, is it not, that at your brief reading of it, I can show it

to you again, that that involves some 23 occasions where a computer was accessed by a particular individual-

30 W That's correct. LR -as opposed to the circumstances in which you were the decision-maker. And I

specifically refer you to what I describe as letters four and five, exhibits- PO 153 and 154. LR 153 and 154. Now, in those instances, you need to see those again? Would it

be helpful to see those exhibits again? 40 W Possibly, yes. LR 153 and 154, please. Thank you So in those instances, both those instances

involved – well, the first one involved a family member of the SO accessing the son-

W Yes.

UNPROOFED TRANSC

RIPT



LR -for the purposes of providing a demerit history. It was a family member. It was, as you said, a good deal of remorse, a strong performance history and, indeed, no detriment was suffered as a result or no benefit experienced as a result of that information UI-

W That's correct. . LR Similarly, in the later case, it was done for a friend, an ex-employee's husband

and grandson. Similarly, a family issue. And no personal financial benefit? 10 W That's correct. . LR And certainly nothing like the 23 occasions in which the public records were

accessed by a member of the QPS.

Finally, Mr MAGOFFIN, in circumstances where you've had experience over a number of years in conducting your role, and you've commented to the Commissioner that you've become -- the processes has become far more robust over recent years, and some of the instances you've referred to, or were taken to, date back to 2015/2016. 20

In circumstances where you've had occasion to, either through yourself or through the ESU, refer matters to the police, the police officer looked at those matters and determine whether there's a basis upon which to prosecute. And you've had an ability, no doubt, to develop a level of professional integrity associated with that process, that’s that you can fairly, based upon your experience, make a judgment as to whether you think it is a matter that is appropriate to be referred in those circumstances?

W That's correct. 30 LR And you've been many years in the current position and, in fact, you're used as

a decision-maker by other departments as well- W That's correct. LR -because of your experience? W That's right. 40 LR Thank you. No further questions. PO Thank you. Mr MAGOFFIN, I suppose, just to be clear about one of the

purposes of this hearing and, in particular showing you Exhibit 155, which is the matter of BANKS, the police matter-

W Yes.

UNPROOFED TRANSC

RIPT



PO -is to make it clear, because there has been some confusion or doubt about this point, that section 408E in the Criminal Code, which is computer hacking it is called colloquially, so far as it applies to these sorts of cases, a benefit obtained is simply access to this information. You don't have to disclose it and get a benefit, a tangible benefit as the definition of a “benefit” in the Criminal Code itself indicates.

So I suppose having seen all of that here, and if you didn't appreciate before, do you now accept that the law supports the view that if someone as an employee without authority accesses information in the database, even if it’s not disclosed, 10 that is obtaining a benefit and meets the bald requirements of a criminal offence under 408E of the Code?

W Yes, I do. PO And as I say, that might be of assistance to you when you're looking at these

cases and assessing them and judging the seriousness in line with your current policy at DTMR of looking, in the first instance at least, of a criminal case, because just accessing is a benefit which meets the criminal case.

20 W Absolutely. PO And I think, as you correctly said I think, and the experience in the inquiry and

more generally outside the inquiry indicates that this, although there are some IT solutions that can be tweaked, the fundamental issue here for this sort of behaviour is a cultural one.

W Absolutely. PO And you have correctly recognised that and you see it as being a need for 30

widespread understanding and training of staff to look at their behaviour in stopping this sort of transgression.

W Absolutely. PO Yes. W Commissioner, if I could just make one point in that theme, is that our staff, our

business transacts somewhere in the vicinity of 16.4 million transactions a year. So if you put that into context of the number of breaches that we're dealing with 40 here, and I'm not - by no way am I lessening the importance of this, but, again, we're doing what I believe as much as we can, and we'll continue to be vigilant in our approach to this, and we'll go further on that maturity journey and using whatever tools and techniques we can to make sure we uphold the responsibility that we're given.

PO Certainly. Ms FOTHERINGHAM, do you have anything arising out of the

examination of Mr HUMBLE?

UNPROOFED TRANSC

RIPT



CA Yes, I do. And if I could have a short adjournment? PO Okay. We’ll just stand it down for whatever time you need and you let me know

when you're ready. CA Yes, thank you HRO This hearing is adjourned. 10 SHORT ADJOURNMENT HRO All stand. This hearing has resumed. PO Okay. CA I'll just show you, Mr MAGOFFIN, a table of the outcomes with respect to

referrals to the Queensland Police Service that we just went through earlier in your evidence.

20 W Thank you. CA That's what we went through before? W That's correct. CA I tender that document. PO Exhibit 156. 30 ADMITTED AND MARKED EXHIBIT 156 CA I don't have any further questions for Mr MAGOFFIN. PO Thank you. You have nothing Mr HUMBLE out of that? LR Only just to reiterate that in respect of Exhibit 156, that’s – those QPS referrals

are managed by the Ethical Standards Unit, Mr MAGOFFIN? W That's correct. 40 LR And you have very limited personal knowledge of the outcomes associated with

that? W That's correct. . LR Thank you.

UNPROOFED TRANSC

RIPT



PO Thank you. All right, you want Mr MAGOFFIN excused? CA Yes. PO Thanks for coming, Mr MAGOFFIN. You're excused. W Thank you. CA That is the last witness for today. And then the next one is scheduled for Friday,

at 10am. . 10 PO Okay. So we will adjourn until 10am on Friday. HRO All stand. This hearing is adjourned. END OF SESSION

UNPROOFED TRANSC

RIPT

official copy 1 of 1 unproofed transcriptmain roads · 20-11-2019 · official copy 1 of 1 ....

Documents